This Privacy Policy explains how Valley Roots Co-op Ltd (referred to as "we," "us," or "our") collects, uses, and protects your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Contact Details

• Full Legal Name: Valley Roots Co-op Ltd
• Company Registration Number: 17096813
• Address: Valcraft Works, Moll Springs, Netherton, Huddersfield, HD4 7DN

Primary Email: [email protected]

2. Data We Collect

We may collect and process the following types of personal information:

• Identity Data: Names of team members, directors, and subscribers.
• Contact Data: Email addresses, phone numbers, and physical delivery addresses.
• Financial Data: Payment details for subscriptions and business turnover records.
• Technical Data: IP addresses and browser information when you visit our website.
• Marketing Data: Your preferences for receiving our newsletters.

3. How We Use Your Data

We use your information to:

• Manage your vegetable box subscription and deliver products.
• Communicate with you regarding your account or support needs.
• Comply with legal obligations, such as filing records with Companies House.
• Improve our services through market research and customer feedback.

4. Lawful Basis for Processing

We process data under the following legal bases:

• Contract: To fulfil our agreement to provide you with goods or services.
• Legal Obligation: To comply with UK law (e.g., tax and company records).
• Consent: Where you have explicitly opted in to receive marketing.
• Legitimate Interests: To manage and improve our business operations efficiently.

5. Data Sharing

We may share your information with:

• Service Providers: Such as 123 Reg (email hosting) and Xero (accounting).
• Delivery Partners: Local producers involved in the "Village-to-Door" scheme.
• Regulatory Bodies: Such as Companies House and the ICO if required by law.

6. Data Retention and Security

• Retention: We keep personal data only as long as necessary to fulfil the purposes for which it was collected or to comply with legal requirements.
• Security: We use encryption and secure systems (e.g., multi-factor authentication) to prevent unauthorized access.

7. Your Rights

Under UK GDPR, you have the right to:

• Access: Request copies of the data we hold about you.
• Rectification: Ask us to correct inaccurate information.
• Erasure: Request that we delete your data in certain circumstances.
• Object/Restrict: Challenge how we process your data.
• Complaints: You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) (www.ico.org.uk).